# auth.md

ritetext's public catalog APIs are **unauthenticated**. Agents do not register users, mint access tokens, or present identity assertions to call the MCP server or keep-alive ping. There is no account system.

## Audience

Agents that need product facts, PDF tool URLs, or editor capabilities for ritetext — a free, privacy-first PDF editor that runs entirely in the browser.

## Registration

- Supported identity types: `anonymous`
- Credential types: `none`
- Registration endpoint: `https://ritetext.com/agent/register` (`POST`)
- Claim endpoint: `https://ritetext.com/agent/claim` (`POST`) — unused; there are no user accounts to claim
- Protected resource metadata: `https://ritetext.com/.well-known/oauth-protected-resource`
- Authorization server metadata: `https://ritetext.com/.well-known/oauth-authorization-server`

`POST /agent/register` with `{"type":"anonymous"}` returns a confirmation that no credential is issued. You may skip registration and call the MCP endpoint directly.

## How to call the API

1. Discover APIs at `https://ritetext.com/.well-known/api-catalog` or OpenAPI at `https://ritetext.com/openapi.json`.
2. Connect to the Streamable HTTP MCP server at `https://ritetext.com/api/public/mcp` with no `Authorization` header.
3. Use tools `get_app_info`, `get_pdf_tools`, `get_routes`, `get_feature_status`, `get_editor_capabilities`, and `search_catalog`.

An optional opaque token `public` with scope `catalog.read` is advertised for clients that insist on OAuth client-credentials. The MCP server does not require or validate it.

## Scopes

- `catalog.read` — read product catalog metadata (the only implemented scope)

## Do not

- Upload user PDFs to ritetext. Processing is client-side only.
- Claim that ritetext supports OCR, true redaction, or user accounts.